Research map / Adversarial robustness and security / Attacks on text and graphs
RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RobustKV, a jailbreak defense that evicts KV-cache entries of the lowest-importance tokens (by attention) so the concealed harmful query loses its informativeness while the LLM keeps benign performance.
Problem
Jailbreak attacks conceal harmful queries within adaptive jailbreak prompts, which defeat existing prompt-level defenses that assume restricted threat models or add substantial overhead.
Approach
Jailbreak prompts must gain high attention-based importance to succeed, which lowers the importance of the harmful query's tokens; RobustKV profiles token importance across layers and heads and evicts the KVs of the lowest-ranked tokens from all layers' caches, starving the LLM of the harmful query content.
Key results
- On Llama2, RobustKV reduces AutoDAN ASR from 58.3% (SnapKV) / 61.5% (no defense) to 6.3%, outperforming SmoothLLM (40.0%) and GoalPriority (30.8%).
- Across GCG, AmpleGCG, and AdvPrompter attacks on Llama2 and Vicuna, RobustKV keeps ASR mostly under 17%, but is weaker on Mistral and Vicuna against AdvPrompter (about 28-30%).
- On AlpacaEval, RobustKV achieves 63% WinRate versus 68% undefended, and on VicunaEval 82.5% vs 92.5% undefended, a smaller utility loss than SmoothLLM or GoalPriority.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RobustKV instead of the strongest listed defense baseline | Llama2 · AutoDAN | ASR: 30.8% -> 6.3% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Vicuna · AutoDAN | ASR: 72.1% -> 8.3% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Llama2 · GCG | ASR: 8.9% -> 7.7% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Mistral · GCG | ASR: 30.9% -> 27.6% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Vicuna · GCG | ASR: 23.7% -> 16.4% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Llama2 · AmpleGCG | ASR: 8.1% -> 6.1% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Vicuna · AmpleGCG | ASR: 10.1% -> 7.1% | Helped |
| Use RobustKV instead of the strongest listed defense baseline | Llama2 · AdvPrompter | ASR: 11.3% -> 7.4% | Helped |
| Use RobustKV instead of GoalPriority | Mistral · AdvPrompter | ASR: 21.8% -> 30.3% | Hurt |
| Use RobustKV instead of GoalPriority | Vicuna · AdvPrompter | ASR: 20.5% -> 28.2% | Hurt |
| Evict the lowest-ranked 20% of tokens with deterministic rather than randomized selection (ablation) | RobustKV on Llama2 · AutoDAN | ASR | Helped |
| Increase the eviction rate (ablation) | RobustKV on Llama2 · AutoDAN | ASR | Helped |
Surprising findings
- Applying existing KV eviction methods such as SnapKV directly as a defense provides little protection against jailbreak attacks.
- Harmful query duplication is an effective adaptive attack against RobustKV, raising ASR until de-duplication is added.
Limitations
- Weaker against AdvPrompter on Mistral and Vicuna, where attacks can bypass safeguards without raising prompt importance.
- Adaptive attacks such as harmful query duplication can raise ASR, requiring an extra de-duplication step.
- Evaluation limited to three 7B open models and four white-box attacks.
Experimental setup
Datasets: AdvBench AlpacaEval VicunaEval LongBench
Benchmarks: AdvBench AlpacaEval VicunaEval LongBench
Metrics: attack success rate ASR-R ASR-G WinRate Rouge-L
Baselines: SmoothLLM GoalPriority SnapKV H2O No Defense
Builds on: SnapKV H2O SmoothLLM GoalPriority
Closest papers by meaning
- Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks (NeurIPS 2024 · similarity 0.91)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.91)
- Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing (NeurIPS 2026 · similarity 0.90)
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.90)
- Fight Back Against Jailbreaking via Prompt Adversarial Tuning (NeurIPS 2024 · similarity 0.90)
- Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.